> ## Documentation Index
> Fetch the complete documentation index at: https://docs.audimate.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Manage your sign-in email, password, and two-factor authentication, save recovery codes, and understand what changes mean for signed-in devices.

Protect your sign-in and recover access when your password or authenticator is unavailable.

## Email address

Your sign-in email and verification status live on the **Security** tab.

Click **Change email** to switch to a different address. Audimate sends a confirmation link to the
**new** address, and your sign-in email stays as-is until you click it. Audimate also emails your
**current** address to say a change was requested. That notice carries no link that changes
anything: it exists so that if someone else asks to move your account, you hear about it while the
account is still yours.

If your address shows **Pending verification**, click **Resend verification** for a fresh link.

<Warning>
  If a security email arrives and it was not you, treat the account as compromised. Reset your password from **Forgot
  password?** on the sign-in page, then email [security@audimate.ai](mailto:security@audimate.ai).
</Warning>

## Password

Passwords must be at least **10 characters** and include upper and lower case letters, a number, and
a symbol. Saving a new password signs you out of every other browser and device, and your current
session stays. Every change emails your sign-in address to confirm it happened, and says whether
other devices were signed out.

If you signed up with Google or Microsoft and have no password yet, click **Send setup link**. You
can then sign in with either method.

If you cannot sign in, click **Forgot password?** on the sign-in page. The reset link is valid for
**one hour**. Setting a new password signs out every other session automatically.

<Note>
  **Resend verification**, **Send setup link**, password resets, and **Resend email** on the confirmation screen shown
  right after sign-up all enter a **30-second** cooldown after each click, showing **Resend in Ns**. Requests beyond
  that return a temporary error. Wait for the cooldown, and check your spam folder before requesting another.
</Note>

## Two-factor authentication

Two-factor authentication (2FA) requires a second verification step when you sign in. Audimate uses
TOTP, meaning codes from an authenticator app like 1Password, Authy, or Google Authenticator.

2FA requires a password on your account. If you signed up with a social provider and have not set
one, **Enable** is disabled and reads **Set a password first**. Use **Send setup link** under
[Password](/account/security#password) first.

<Steps>
  <Step title="Open the Two-factor section">
    Click **Enable two-factor authentication** and enter your current password to confirm.
  </Step>

  <Step title="Scan the QR code">
    Scan it in your authenticator app. If your app cannot scan, click **Enter manually** to copy the setup key.
  </Step>

  <Step title="Enter the verification code">
    Type the six-digit code from your authenticator. Audimate enables 2FA on your account.
  </Step>

  <Step title="Save your backup codes">
    Copy, download, or print the **ten** backup codes and store them somewhere safe. You must check **I've saved these
    codes somewhere safe** before finishing.
  </Step>
</Steps>

Every sign-in then prompts for a six-digit code, or a backup code. Check **Trust this browser for 30
days** on the prompt to skip 2FA from that browser.

| Action               | What it does                                       |
| -------------------- | -------------------------------------------------- |
| **Regenerate codes** | Retires your old codes and issues a fresh ten      |
| **Re-setup**         | Scans a fresh QR code, and issues new backup codes |
| **Remove**           | Disables 2FA                                       |

All three ask for your current password. **Re-setup** also invalidates your previously saved backup
codes, so save the new set before closing the dialog.

<Warning>
  Regenerating or re-setting up stops your previous backup codes working immediately. If you have lost your
  authenticator, use a backup code to sign in before you do either.
</Warning>

Audimate emails you when two-factor is turned on and when it is turned off. The **off** email
matters most: turning 2FA off is the most useful thing someone who has taken over your session can
do, and it is otherwise silent. Two details keep an expected email from looking alarming. Re-setup
sends a "turned on" email, because re-scanning completes enrollment again. Regenerating backup codes
sends nothing, because it does not change whether 2FA is on.

If your organization requires
[2-factor for admins](/account/organization#require-2-factor-for-admins), admins and owners cannot
perform admin actions without it.

## Related

<Columns cols={2}>
  <Card title="Your account" icon="user" href="/account/profile">
    Manage your profile and personal preferences.
  </Card>

  <Card title="Organization management" icon="building" href="/account/organization">
    Find the settings for your workspace.
  </Card>
</Columns>